Microsoft readies its security arsenal

SAN FRANCISCO — Bill Gates suggests that computer users go for a layered look, but not with the V-neck sweaters he's fond of wearing.

The Microsoft chairman is proposing consumers apply multiple layers of security products — available soon from his company — to insulate and protect themselves from spyware, identity theft and other Internet security risks.

Those layers include a new, more-secure browser, Internet Explorer 7, which is being released later this year — a year ahead of schedule.

In a presentation to the 11,000 computer-security professionals at the RSA Conference, Gates provided few details about the updated browser. But a Microsoft manager said later the move stemmed in part from financial institutions asking the company to do more about "phishing" attacks that display false Web pages to steal customer data.

Gates also said the anti-spyware software Microsoft is testing will be free to Windows customers later in the year. Spyware — software unsuspectingly downloaded into a computer to track a user's actions — is "something we've got to nip down before it gets worse than it is today," Gates said.

"We've made the decision that all of our Windows licensees should have that capability."

Microsoft will also release a security product for consumers that includes antivirus technology, but Gates indicated it won't be free.

Other security-software vendors brushed off the threat from Microsoft's new security products. "I'm more focused on what our customers' needs are," said Symantec Chief Executive John Thompson.

Asked if Symantec would raise antitrust issues, Thompson said he'd prefer not to take the fight to Washington, D.C. "I'd rather fight Microsoft in the marketplace, because I'm convinced we can whip them," he said.

It's unclear how much the new products will affect Microsoft's bottom line. Gates said they are part of a broader effort to make computing more trustworthy and help people embrace new online activities.

Catalyst for upgrade

In the short term, even the free products could help Microsoft's earnings by prompting users to upgrade to the latest version of Windows.

The new browser, to be available in a test version midyear, will work only on Windows XP with the Service Pack 2 upgrade kit installed.

The spyware product will work on systems using Windows XP and 2000 but not earlier versions, said Gytis Barzdukas, director of product management for the Windows security business and technology unit.

Barzdukas said the best protection comes from the layers of security provided by the latest offerings.

Microsoft also wants to get the products out soon, and making them work on older systems would require more testing.

The push comes as pressure continues on Microsoft to improve security of its products. In addition, competitors have made some headway in part by highlighting their security protections.

Internet Explorer remains the dominant browser by far, but use of Firefox has grown rapidly since the freely distributed browser was introduced last year by the Mozilla Foundation.

Meanwhile, scammers are continuing to improve their tricks, according to Gartner analyst Avivah Litan. She said 60 million Americans reported in a survey last year that they were targets of phishing scams.

The ploys led to $1.2 billion in fraud losses last year, she said. "It's definitely a successful trick."

At least one critic of Microsoft's security practices was impressed yesterday by the company's offerings and apparently deeper grasp of the challenges it's facing.

Message "realistic"

"Instead of making promises that he [Gates] absolutely couldn't keep I thought he was realistic," security consultant Bruce Schneier said.

Gates used terms like "mitigate" rather than "eliminate" in his speech, for instance.

Barzdukas said earlier speeches that set bolder goals were intended partly to set the bar high for employees.

"Sometimes a leader strikes a tone to rally the troops, especially initially, that is really aspirational," he said. "I think that is what we were doing."

As for the state of consumers' online security, Barzdukas said it's definitely improved if customers are using the latest technology. "I don't think you can ever say that customers are, quote, secure," he said. "If somebody wants to break into your house and you have six deadbolts, is that enough?

"If they're maintaining their PCs, their risk of exposure to a vulnerability is pretty low," he said.

Brier Dudley: 206-515-5687 or bdudley@seattletimes.com